Re: [OPSEC] minutes part 2

>
> Given the relatively recent information indicating "serious
> attacks" on SHA (the quote is from NIST [1]), including an
> acknowledged attack on SHA-1 [2], previous beliefs that SHA
> might be stronger are no longer supported by the science at hand.
> MD5 is also subject to "serious attacks" that have been published.
> So the data available says that both SHA and MD5 have cause
> for serious concern.

OSPF WG charter (http://www.ietf.org/html.charters/ospf-charter.html)
says "Nov 2008	Develop stronger authentication mechanisms for OSPFv2
and submit to IESG as a Proposed Standard". It is against this charter
item that they're probably working on the
draft-ietf-ospf-hmac-sha-03.txt. You might want to let them know that
its not good enough, as SHA has same problems, if not any worse, than
MD5.

You also might want to look at
http://www.ietf.org/proceedings/07mar/slides/ospf-3/sld2.htm which
tells you why this particular draft was adopted as a WG doc.

And isnt it ironic that you are also the author of RIP for SHA support
(RFC 4822) and IS-IS extensions for SHA
(draft-ietf-isis-hmac-sha-07.txt)? If there is no need for these,
except for one customer that you tout, then you should have probably
called these RFCs and drafts as RIP-SHA for <customer name> and
ISIS-SHA for <customer name>. Why an RFC if they offer no benefit to
the community? I am surprised, really I am, as to why you have still
not drafted an OSPF SHA extension for your_favorite_customer?

Glen
_______________________________________________
OPSEC mailing list
OPSEC@ietf.org
https://www.ietf.org/mailman/listinfo/opsec